[36565] in bugtraq
Php Vulnerability N. 2
daemon@ATHENA.MIT.EDU (Stefano Di Paola)
Sat Sep 18 15:35:29 2004
From: Stefano Di Paola <stefano.dipaola@wisec.it>
To: Bugtraq <bugtraq@securityfocus.com>
Cc: vulnwatch <vulnwatch@vulnwatch.org>
Content-Type: text/plain
Message-Id: <1095268057.2818.20.camel@localhost>
Mime-Version: 1.0
Date: Wed, 15 Sep 2004 19:07:37 +0200
Content-Transfer-Encoding: 7bit
Let's go for the second one:
=========================================
Title: Overwrite $_FILE array in rfc1867 - Mime multipart/form-data File
Upload
Affected: Php <= 5.0.1
Not Affected: it seems none
Vulnerability Type: Possible write of a downloaded file in an arbitrary
location.
Vendor Status: Vendor has released a fix on cvs.php.net
==Summary:
Bad array parsing in rfc1867.c could lead to overwrite $_FILES array
elements.
==Description:
I don't know if releasing a POC for this vuln is a good thing because php is used widely in the net...
so if you are interested feel free to contact me.
==Solution:
Authors where contacted and they have released the patch
that can be found on the CVS
cvs.php.net
=================================================
Regards,
Stefano
-..----=oOOo=----=oOOo=---------
Stefano Di Paola
Software Engineer
stefano.dipaola_at_wisec_dot_it
stefano.dipaola1_at_tin_dot_it
-------------------------------
